Timestamp normalized counter data

ABSTRACT

A method including collecting, from a cable modem termination system (CMTS), counter data corresponding to usage of a network resource, wherein the counter data includes timestamp data, converting the counter data into timestamp normalized counter data by dividing the counter data among a plurality of buckets according to the timestamp data, and storing the timestamp normalized counter data.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is a continuation of U.S. application Ser. No.14/306,700 filed Jun. 17, 2014. The complete disclosures of U.S.application Ser. No. 14/306,700 is expressly incorporated herein byreference in its entirety for all purposes.

FIELD OF THE INVENTION

The present invention relates generally to the electrical, electronic,and computer arts, and more particularly relates to enhanced counterdata in a network system.

BACKGROUND OF THE INVENTION

Conventionally, a cable network predominantly operated as a vehicle fordelivering entertainment. With the advent of the Internet and the risein demand for broadband two-way access, the cable industry began to seeknew ways of utilizing its existing plant. Pure coaxial (“coax”) cablenetworks were replaced with hybrid fiber networks (HFNs) using opticalfiber from the head end to the demarcation with the subscriber coax(usually at a fiber node). Currently, a content-based network, anon-limiting example of which is a cable television network, may affordaccess to a variety of services besides television, for example,broadband Internet access, telephone service, and the like.

One significant issue for a cable operator desiring to provide digitalservice is the configuration of its network. Designed for one-waydelivery of broadcast signals, the existing cable network topology wasoptimized for downstream only (i.e., towards the subscriber) service.New equipment had to be added to the network to provide two-waycommunication. To reduce the cost of this equipment and to simplify theupgrade of the broadcast cable for two-way digital traffic, standardswere developed for a variety of new cable-based services. The first ofthese standards, the Data Over Cable System Interface Standard (DOCSIS®standard), was released in 1998. DOCSIS® establishes standards for cablemodems and supporting equipment. DOCSIS® (Data Over Cable ServiceInterface Specification) is a registered mark of Cable TelevisionLaboratories, Inc., 400 Centennial Parkway Louisville Colo. 80027, USA,and will be referred to for the remainder of this disclosure in capitalletters, without the ® symbol, for convenience. There are many types ofIP networks besides cable networks. Other wired IP networks include, forexample, digital subscriber line (DSL), fiber to the home, fiber to thecurb, and so on. Wireless IP networks include Wi-Fi, wireless ISP(Internet Service Provider), WiMAX, satellite internet, and mobilebroadband.

Within IP networks, one method for gleaming information (e.g., serviceusage) is the Internet Protocol Detail Record (IPDR).

SUMMARY OF THE INVENTION

Principles of the present invention provide a system, method, andcomputer program product for timestamp normalized data in a contentnetwork. In one aspect, an exemplary method includes collecting, from acable modem termination system (CMTS), counter data corresponding tousage of a network resource, wherein the counter data includes timestampdata, converting the counter data into timestamp normalized counter databy dividing the counter data among a plurality of buckets according tothe timestamp data, and storing the timestamp normalized counter data.In another aspect, an exemplary network system includes a cable modemtermination system (CMTS) providing a network resource to at least onesubscriber of the network system, a data warehouse, a collectorcollecting, from the CMTS, counter data corresponding to usage of thenetwork resource, wherein the counter data includes timestamp data, anda mediator configured to timestamp and normalize the counter data,wherein the collector and the mediator are disposed between the CMTS andthe data warehouse.

As used herein, “facilitating” an action includes performing the action,making the action easier, helping to carry the action out, or causingthe action to be performed. Thus, by way of example and not limitation,instructions executing on one processor might facilitate an actioncarried out by instructions executing on a remote processor, by sendingappropriate data or commands to cause or aid the action to be performed.For the avoidance of doubt, where an actor facilitates an action byother than performing the action, the action is nevertheless performedby some entity or combination of entities.

One or more embodiments of the invention or elements thereof can beimplemented in the form of an article of manufacture including a machinereadable medium that contains one or more programs which when executedimplement one or more method steps set forth herein; that is to say, acomputer program product including a tangible computer readablerecordable storage medium (or multiple such media) with computer usableprogram code for performing the method steps indicated. Furthermore, oneor more embodiments of the invention or elements thereof can beimplemented in the form of an apparatus (e.g., an intermediary dynamichost configuration protocol relay device) including a memory and atleast one processor that is coupled to the memory and operative toperform, or facilitate performance of, exemplary method steps. Yetfurther, in another aspect, one or more embodiments of the invention orelements thereof can be implemented in the form of means for carryingout one or more of the method steps described herein; the means caninclude (i) specialized hardware module(s), (ii) software module(s)stored in a tangible computer-readable recordable storage medium (ormultiple such media) and implemented on a hardware processor, or (iii) acombination of (i) and (ii); any of (i)-(iii) implement the specifictechniques set forth herein. The means do not include a transmissionmedium per se or a disembodied signal per se.

Techniques of the present invention can provide substantial beneficialtechnical effects. For example, one or more embodiments provide one ormore of:

-   -   enabling a correlation and validation among time series data        from multiple data sources with different temporal granularity        and irregularity, and    -   reducing overhead by limiting or eliminating data-pulling via        SNMP from the access systems for capacity management of access        networks.

These and other features and advantages of the present invention willbecome apparent from the following detailed description of illustrativeembodiments thereof, which is to be read in connection with theaccompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an exemplary embodiment of a system, withinwhich one or more aspects of the invention can be implemented;

FIG. 2 is a functional block diagram illustrating an exemplary hybridfiber-coaxial (HFC) divisional network configuration, useful within thesystem of FIG. 1;

FIG. 3 is a functional block diagram illustrating one exemplary HFCcable network head-end configuration, useful within the system of FIG.1;

FIG. 4 is a functional block diagram illustrating one exemplary localservice node configuration useful within the system of FIG. 1;

FIG. 5 is a functional block diagram of a premises network, including anexemplary centralized customer premises equipment (CPE) unit,interfacing with a head end such as that of FIG. 3;

FIG. 6 is a functional block diagram of an exemplary centralized CPEunit, useful within the system of FIG. 1;

FIG. 7 is a block diagram of a computer system useful in connection withone or more aspects of the invention;

FIG. 8 illustrates network architecture according to an embodiment ofthe present invention;

FIG. 9 illustrates a production topology according to an embodiment ofthe present invention;

FIG. 10 illustrates a collector-mediator-database architecture accordingto an embodiment of the present invention;

FIG. 11 is a graph of service consumption according to an embodiment ofthe present invention;

FIG. 12 is an illustration of timestamp normalized data according to anembodiment of the present invention; and

FIG. 13 illustrates network architecture including a hub site accordingto an embodiment of the present invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Embodiments of the invention may be employed in a variety of settings. Anon-limiting exemplary embodiment will be described within the contextof a cable multiple system operator (MSO) providing one or more networksincluding one or more content-based networks. It is to be emphasizedthat one or more embodiments have applicability wherever service usagedata is needed in a network, and can be used in connection with manydifferent kinds of networks besides content networks, such as networkscarrying primarily or solely data. In one exemplary embodiment of thepresent invention, Internet Protocol Detail Record (IPDR) data isutilized for Usage-Based Billing (UBB) purposes, wherein, raw data isenriched through the processing of the data in a timestamp normalizedregime, which enables aggregated data volume analytics (for example,enhanced IPDR reporting).

As noted, IP-based data services may be provided over a variety ofnetworks. Purely by way of example and not limitation, some embodimentswill be shown in the context of a cable multi-service operator (MSO)providing data services as well as entertainment services. FIG. 1 showsan exemplary system 100, according to an aspect of the invention. System100 includes a regional data center (RDC) 140, and one or moredivisions, represented by division head ends 150. RDC 140 and head ends150 are interconnected by a network 160; by way of example and notlimitation, a dense wavelength division multiplex (DWDM) network.Elements 140, 150 on network 160 may be operated, for example, by or onbehalf of a cable MSO, and may be interconnected with a global system ofinterconnected computer networks that use the standardized InternetProtocol Suite (TCP/IP)(transfer control protocol/Internet protocol),commonly called the Internet 110; for example, via router 130. In one ormore non-limiting exemplary embodiments, router 130 is apoint-of-presence (“POP”) router; for example, of the kind availablefrom Juniper Networks, Inc., Sunnyvale, Calif., USA.

Head ends 150 may each include a head end router (HER) 151 whichinterfaces with network 160. Head end routers 151 are omitted fromfigures below to avoid clutter.

RDC 140 may include one or more provisioning servers (PS) 143, one ormore Video Servers (VS) 144, one or more content servers (CS) 145, andone or more e-mail servers (ES) 146. The same may be interconnected toone or more RDC routers (RR) 141 by one or more multi-layer switches(MLS) 142. RDC routers 141 interconnect with network 160.

A national data center (NDC) 120 is provided in some instances; forexample, between router 130 and Internet 110.

FIG. 2 is a functional block diagram illustrating an exemplarycontent-based (e.g., hybrid fiber-coaxial (HFC)) divisional networkconfiguration, useful within the system of FIG. 1. See, for example, USPatent Publication 2006/0130107 of Gonder et al., entitled “Method andapparatus for high bandwidth data transmission in content-basednetworks,” the complete disclosure of which is expressly incorporated byreference herein in its entirety for all purposes. The variouscomponents of the network 200 include (i) one or more data andapplication origination points 102; (ii) one or more applicationdistribution servers 104; (iii) one or more video-on-demand (VOD)servers 105, and (v) consumer premises equipment or customer premisesequipment (CPE) 106. The distribution server(s) 104, VOD servers 105 andCPE(s) 106 are connected via a bearer (e.g., HFC) network 101. Servers104, 105 can be located in head end 150. A simple architecture is shownin FIG. 2 for illustrative brevity, although it will be recognized thatcomparable architectures with multiple origination points, distributionservers, VOD servers, and/or CPE devices (as well as different networktopologies) may be utilized consistent with embodiments of theinvention. For example, the head-end architecture of FIG. 3 (describedin greater detail below) may be used.

The data/application origination point 102 comprises any medium thatallows data and/or applications (such as a VOD-based or “Watch TV”application) to be transferred to a distribution server 104, forexample, over network 103. This can include for example a third partydata source, application vendor website, compact disk read-only memory(CD-ROM), external network interface, mass storage device (e.g.,Redundant Arrays of Inexpensive Disks (RAID) system), etc. Suchtransference may be automatic, initiated upon the occurrence of one ormore specified events (such as the receipt of a request packet oracknowledgement (ACK)), performed manually, or accomplished in anynumber of other modes readily recognized by those of ordinary skill,given the teachings herein. For example, in one or more embodiments,network 103 may correspond to network 160 of FIG. 1, and the data andapplication origination point may be, for example, within NDC 120, RDC140, or on the Internet 110. Head end 150, HFC network 101, and CPEs 106thus represent the divisions which were represented by division headends 150 in FIG. 1.

The application distribution server 104 comprises a computer systemwhere such applications can enter the network system. Distributionservers per se are well known in the networking arts, and accordinglynot described further herein.

The VOD server 105 comprises a computer system where on-demand contentcan be received from one or more of the aforementioned data sources 102and enter the network system. These servers may generate the contentlocally, or alternatively act as a gateway or intermediary from adistant source.

The CPE 106 includes any equipment in the “customers' premises” (orother appropriate locations) that can be accessed by a distributionserver 104 or a cable modem termination system 156 (discussed below withregard to FIG. 3). Non-limiting examples of CPE are set-top boxes andhigh-speed cable modems for providing high bandwidth Internet access inpremises such as homes and businesses.

Also included (for example, in head end 150) is a dynamic bandwidthallocation device (DBWAD) 107 such as a global session resource manager,which is itself a non-limiting example of a session resource manager.

FIG. 3 is a functional block diagram illustrating one exemplary HFCcable network head-end configuration, useful within the system ofFIG. 1. As shown in FIG. 3, the head-end architecture 150 comprisestypical head-end components and services including billing module 152,subscriber management system (SMS) and CPE configuration managementmodule 3308, cable-modem termination system (CMTS) and out-of-band (OOB)system 156, as well as LAN(s) 158, 160 placing the various components indata communication with one another. In one or more embodiments, thereare multiple CMTSs. Each may be coupled to an HER 151, for example. See,e.g., FIGS. 1 and 2 of co-assigned U.S. Pat. No. 7,792,963 of inventorsGould and Danforth, entitled METHOD TO BLOCK UNAUTHORIZED NETWORKTRAFFIC IN A CABLE DATA NETWORK, the complete disclosure of which isexpressly incorporated herein by reference in its entirety for allpurposes.

It will be appreciated that while a bar or bus LAN topology isillustrated, any number of other arrangements (e.g., ring, star, etc.)may be used consistent with the invention. It will also be appreciatedthat the head-end configuration depicted in FIG. 3 is high-level,conceptual architecture and that each multi-service operator (MSO) mayhave multiple head-ends deployed using custom architectures.

The architecture 150 of FIG. 3 further includes amultiplexer/encrypter/modulator (MEM) 162 coupled to the HFC network 101adapted to “condition” content for transmission over the network. Thedistribution servers 104 are coupled to the LAN 160, which providesaccess to the MEM 162 and network 101 via one or more file servers 170.The VOD servers 105 are coupled to the LAN 158, although otherarchitectures may be employed (such as for example where the VOD serversare associated with a core switching device such as an 802.3z GigabitEthernet device; or the VOD servers could be coupled to LAN 160). Sinceinformation is typically carried across multiple channels, the head-endshould be adapted to acquire the information for the carried channelsfrom various sources. Typically, the channels being delivered from thehead-end 150 to the CPE 106 (“downstream”) are multiplexed together inthe head-end and sent to neighborhood hubs (refer to description of FIG.4) via a variety of interposed network components.

Content (e.g., audio, video, etc.) is provided in each downstream(in-band) channel associated with the relevant service group. (Note thatin the context of data communications, internet data is passed bothdownstream and upstream.) To communicate with the head-end orintermediary node (e.g., hub server), the CPE 106 may use theout-of-band (OOB) or DOCSIS® (Data Over Cable Service InterfaceSpecification) channels (registered mark of Cable TelevisionLaboratories, Inc., 400 Centennial Parkway Louisville Colo. 80027, USA)and associated protocols (e.g., DOCSIS 1.x, 2.0, or 3.0). The OpenCable™Application Platform (OCAP) 1.0, 2.0, 3.0 (and subsequent) specification(Cable Television laboratories Inc.) provides for exemplary networkingprotocols both downstream and upstream, although the invention is in noway limited to these approaches. All versions of the DOCSIS and OCAPspecifications are expressly incorporated herein by reference in theirentireties for all purposes.

Furthermore in this regard, DOCSIS is an internationaltelecommunications standard that permits the addition of high-speed datatransfer to an existing cable TV (CATV) system. It is employed by manycable television operators to provide Internet access (cable Internet)over their existing hybrid fiber-coaxial (HFC) infrastructure. Use ofDOCSIS to transmit data on an HFC system is one non-limiting exemplaryapplication of one or more embodiments. However, one or more embodimentsare generally applicable to IP transport of data, regardless of whatkind of functionality is employed.

It will also be recognized that multiple servers (broadcast, VOD, orotherwise) can be used, and disposed at two or more different locationsif desired, such as being part of different server “farms”. Thesemultiple servers can be used to feed one service group, or alternativelydifferent service groups. In a simple architecture, a single server isused to feed one or more service groups. In another variant, multipleservers located at the same location are used to feed one or moreservice groups. In yet another variant, multiple servers disposed atdifferent location are used to feed one or more service groups.

In some instances, material may also be obtained from a satellite feed1108; such material is demodulated and decrypted in block 1106 and fedto block 162. Conditional access system 157 may be provided for accesscontrol purposes. Network management system 1110 may provide appropriatemanagement functions. Note also that signals from MEM 162 and upstreamsignals from network 101 that have been demodulated and split in block1112 are fed to CMTS and OOB system 156.

Also included in FIG. 3 are a global session resource manager (GSRM)3302, a Mystro Application Server 104A, and a business management system154, all of which are coupled to LAN 158. GSRM 3302 is one specific formof a DBWAD 107 and is a non-limiting example of a session resourcemanager.

An ISP DNS server could be located in the head-end as shown at 3303, butit can also be located in a variety of other places. One or more DHCPserver(s) 3304 can also be located where shown or in differentlocations.

As shown in FIG. 4, the network 101 of FIGS. 2 and 3 comprises afiber/coax arrangement wherein the output of the MEM 162 of FIG. 3 istransferred to the optical domain (such as via an optical transceiver177 at the head-end 150 or further downstream). The optical domainsignals are then distributed over a fiber network to a fiber node 178,which further distributes the signals over a distribution network 180(typically coax) to a plurality of local servicing nodes 182. Thisprovides an effective 1-to-N expansion of the network at the localservice end. Each node 182 services a number of CPEs 106. Furtherreference may be had to US Patent Publication 2007/0217436 of Markley etal., entitled “Methods and apparatus for centralized content and datadelivery,” the complete disclosure of which is expressly incorporatedherein by reference in its entirety for all purposes. In one or moreembodiments, the CPE 106 includes a cable modem, such as aDOCSIS-compliant cable modem (DCCM). Please note that the number of CPE106 per node 182 may be different than the number of nodes 182.

Certain additional aspects of video or other content delivery will nowbe discussed for completeness, it being understood that embodiments ofthe invention have broad applicability to TCP/IP network connectivityfor delivery of messages and/or content. Again, delivery of data over avideo (or other) content network is but one non-limiting example of acontext where one or more embodiments could be implemented.

US Patent Publication 2003-0056217 of Paul D. Brooks, entitled“Technique for Effectively Providing Program Material in a CableTelevision System,” the complete disclosure of which is expresslyincorporated herein by reference for all purposes, describes oneexemplary broadcast switched digital architecture, although it will berecognized by those of ordinary skill that other approaches andarchitectures may be substituted. In a cable television system inaccordance with the Brooks invention, program materials are madeavailable to subscribers in a neighborhood on an as needed basis.Specifically, when a subscriber at a set-top terminal selects a programchannel to watch, the selection request is transmitted to a head end ofthe system. In response to such a request, a controller in the head enddetermines whether the material of the selected program channel has beenmade available to the neighborhood. If it has been made available, thecontroller identifies to the set-top terminal the carrier which iscarrying the requested program material, and to which the set-topterminal tunes to obtain the requested program material. Otherwise, thecontroller assigns an unused carrier to carry the requested programmaterial, and informs the set-top terminal of the identity of the newlyassigned carrier. The controller also retires those carriers assignedfor the program channels which are no longer watched by the subscribersin the neighborhood. Note that reference is made herein, for brevity, tofeatures of the “Brooks invention”—it should be understood that noinference should be drawn that such features are necessarily present inall claimed embodiments of Brooks. The Brooks invention is directed to atechnique for utilizing limited network bandwidth to distribute programmaterials to subscribers in a community access television (CATV) system.In accordance with the Brooks invention, the CATV system makes availableto subscribers selected program channels, as opposed to all of theprogram channels furnished by the system as in prior art. In the BrooksCATV system, the program channels are provided on an as needed basis,and are selected to serve the subscribers in the same neighborhoodrequesting those channels.

US Patent Publication 2010/0313236 of Albert Straub, entitled“TECHNIQUES FOR UPGRADING SOFTWARE IN A VIDEO CONTENT NETWORK,” thecomplete disclosure of which is expressly incorporated herein byreference for all purposes, provides additional details on theaforementioned dynamic bandwidth allocation device 107.

US Patent Publication 2009/0248794 of William L. Helms, entitled “SYSTEMAND METHOD FOR CONTENT SHARING,” the complete disclosure of which isexpressly incorporated herein by reference for all purposes, providesadditional details on CPE in the form of a converged premises gatewaydevice. Related aspects are also disclosed in US Patent Publication2007/0217436 of Markley et al, entitled “METHODS AND APPARATUS FORCENTRALIZED CONTENT AND DATA DELIVERY,” the complete disclosure of whichis expressly incorporated herein by reference for all purposes.

Reference should now be had to FIG. 5, which presents a block diagram ofa premises network interfacing with a head end of an MSO or the like,providing Internet access. An exemplary advanced wireless gatewaycomprising CPE 106 is depicted as well. It is to be emphasized that thespecific form of CPE 106 shown in FIGS. 5 and 6 is exemplary andnon-limiting, and shows a number of optional features. Many other typesof CPE can be employed in one or more embodiments; for example, a cablemodem, DSL modem, and the like.

CPE 106 includes an advanced wireless gateway which connects to a headend 150 or other hub of a network, such as a video content network of anMSO or the like. The head end is coupled also to an internet (e.g., theInternet) 208 which is located external to the head end 150, such as viaan Internet (IP) backbone or gateway (not shown).

The head end is in the illustrated embodiment coupled to multiplehouseholds or other premises, including the exemplary illustratedhousehold 240. In particular, the head end (for example, a cable modemtermination system 156 thereof) is coupled via the aforementioned HFCnetwork and local coaxial cable or fiber drop to the premises, includingthe consumer premises equipment (CPE) 106. The exemplary CPE 106 is insignal communication with any number of different devices including,e.g., a wired telephony unit 222, a Wi-Fi or other wireless-enabledphone 224, a Wi-Fi or other wireless-enabled laptop 226, a sessioninitiation protocol (SIP) phone, an H.323 terminal or gateway, etc.Additionally, the CPE 106 is also coupled to a digital video recorder(DVR) 228 (e.g., over coax), in turn coupled to television 234 via awired or wireless interface (e.g., cabling, PAN or 802.15 UWB micro-net,etc.). CPE 106 is also in communication with a network (here, anEthernet network compliant with IEEE Std. 802.3, although any number ofother network protocols and topologies could be used) on which is apersonal computer (PC) 232.

Other non-limiting exemplary devices that CPE 106 may communicate withinclude a printer 294; for example over a universal plug and play (UPnP)interface, and/or a game console 292; for example, over a multimediaover coax alliance (MoCA) interface.

In some instances, CPE 106 is also in signal communication with one ormore roaming devices, generally represented by block 290.

A “home LAN” (HLAN) is created in the exemplary embodiment, which mayinclude for example the network formed over the installed coaxialcabling in the premises, the Wi-Fi network, and so forth.

During operation, the CPE 106 exchanges signals with the head end overthe interposed coax (and/or other, e.g., fiber) bearer medium. Thesignals include e.g., Internet traffic (IPv4 or IPv6), digitalprogramming and other digital signaling or content such as digital(packet-based; e.g., VoIP) telephone service. The CPE 106 then exchangesthis digital information after demodulation and any decryption (and anydemultiplexing) to the particular system(s) to which it is directed oraddressed. For example, in one embodiment, a MAC address or IP addresscan be used as the basis of directing traffic within the client-sideenvironment 240.

Any number of different data flows may occur within the network depictedin FIG. 5. For example, the CPE 106 may exchange digital telephonesignals from the head end which are further exchanged with the telephoneunit 222, the Wi-Fi phone 224, or one or more roaming devices 290. Thedigital telephone signals may be IP-based such as Voice-over-IP (VoIP),or may utilize another protocol or transport mechanism. The well knownsession initiation protocol (SIP) may be used, for example, in thecontext of a “SIP phone” for making multi-media calls. The network mayalso interface with a cellular or other wireless system, such as forexample a 3G IMS (IP multimedia subsystem) system, in order to providemultimedia calls between a user or consumer in the household domain 240(e.g., using a SIP phone or H.323 terminal) and a mobile 3G telephone orpersonal media device (PMD) user via that user's radio access network(RAN).

The CPE 106 may also exchange Internet traffic (e.g., TCP/IP and otherpackets) with the head end 150 which is further exchanged with the Wi-Filaptop 226, the PC 232, one or more roaming devices 290, or otherdevice. CPE 106 may also receive digital programming that is forwardedto the DVR 228 or to the television 234. Programming requests and othercontrol information may be received by the CPE 106 and forwarded to thehead end as well for appropriate handling.

FIG. 6 is a block diagram of one exemplary embodiment of the CPE 106 ofFIG. 5. The exemplary CPE 106 includes an RF front end 301, Wi-Fiinterface 302, video interface 316, “Plug n′ Play” (PnP) interface 318(for example, a UPnP interface) and Ethernet interface 304, eachdirectly or indirectly coupled to a bus 312. In some cases, Wi-Fiinterface 302 comprises a single wireless access point (WAP) runningmultiple (“m”) service set identifiers (SSIDs). In some cases, multipleSSIDs, which could represent different applications, are served from acommon WAP. For example, SSID 1 is for the home user, while SSID 2 maybe for a managed security service, SSID 3 may be a managed homenetworking service, SSID 4 may be a hot spot, and so on. Each of theseis on a separate IP subnetwork for security, accounting, and policyreasons. The microprocessor 306, storage unit 308, plain old telephoneservice (POTS)/public switched telephone network (PSTN) interface 314,and memory unit 310 are also coupled to the exemplary bus 312, as is asuitable MoCA interface 391. The memory unit 310 typically comprises arandom access memory (RAM) and storage unit 308 typically comprises ahard disk drive, an optical drive (e.g., CD-ROM or DVD), NAND flashmemory, RAID (redundant array of inexpensive disks) configuration, orsome combination thereof.

The illustrated CPE 106 can assume literally any discrete form factor,including those adapted for desktop, floor-standing, or wall-mounteduse, or alternatively may be integrated in whole or part (e.g., on acommon functional basis) with other devices if desired.

Again, it is to be emphasized that every embodiment need not necessarilyhave all the elements shown in FIG. 6—as noted, the specific form of CPE106 shown in FIGS. 5 and 6 is exemplary and non-limiting, and shows anumber of optional features. Yet again, many other types of CPE can beemployed in one or more embodiments; for example, a cable modem, DSLmodem, and the like.

It will be recognized that while a linear or centralized busarchitecture is shown as the basis of the exemplary embodiment of FIG.6, other bus architectures and topologies may be used. For example, adistributed or multi-stage bus architecture may be employed. Similarly,a “fabric” or other mechanism (e.g., crossbar switch, RAPIDIO interface,non-blocking matrix, TDMA or multiplexed system, etc.) may be used asthe basis of at least some of the internal bus communications within thedevice. Furthermore, many if not all of the foregoing functions may beintegrated into one or more integrated circuit (IC) devices in the formof an ASIC or “system-on-a-chip” (SoC). Myriad other architectures wellknown to those in the data processing and computer arts may accordinglybe employed.

Yet again, it will also be recognized that the CPE configuration shownis essentially for illustrative purposes, and various otherconfigurations of the CPE 106 are consistent with other embodiments ofthe invention. For example, the CPE 106 in FIG. 6 may not include all ofthe elements shown, and/or may include additional elements andinterfaces such as for example an interface for the HomePlug A/Vstandard which transmits digital data over power lines, a PAN (e.g.,802.15), Bluetooth, or other short-range wireless interface forlocalized data communication, etc.

A suitable number of standard 10/100/1000 Base T Ethernet ports for thepurpose of a Home LAN connection are provided in the exemplary device ofFIG. 6; however, it will be appreciated that other rates (e.g., GigabitEthernet or 10-Gig-E) and local networking protocols (e.g., MoCA, USB,etc.) may be used. These interfaces may be serviced via a WLANinterface, wired RJ-45 ports, or otherwise. The CPE 106 can also includea plurality of RJ-11 ports for telephony interface, as well as aplurality of USB (e.g., USB 2.0) ports, and IEEE-1394 (Firewire) ports.S-video and other signal interfaces may also be provided if desired.

During operation of the CPE 106, software located in the storage unit308 is run on the microprocessor 306 using the memory unit 310 (e.g., aprogram memory within or external to the microprocessor). The softwarecontrols the operation of the other components of the system, andprovides various other functions within the CPE. Other systemsoftware/firmware may also be externally reprogrammed, such as using adownload and reprogramming of the contents of the flash memory,replacement of files on the storage device or within other non-volatilestorage, etc. This allows for remote reprogramming or reconfiguration ofthe CPE 106 by the MSO or other network agent.

It should be noted that some embodiments provide a cloud-based userinterface, wherein CPE 106 accesses a user interface on a server in thecloud, such as in NDC 120.

The RF front end 301 of the exemplary embodiment comprises a cable modemof the type known in the art. In some cases, the CPE just includes thecable modem and omits the optional features. Content or data normallystreamed over the cable modem can be received and distributed by the CPE106, such as for example packetized video (e.g., IPTV). The digital dataexchanged using RF front end 301 includes IP or other packetizedprotocol traffic that provides access to internet service. As is wellknown in cable modem technology, such data may be streamed over one ormore dedicated QAMs resident on the HFC bearer medium, or evenmultiplexed or otherwise combined with QAMs allocated for contentdelivery, etc. The packetized (e.g., IP) traffic received by the CPE 106may then be exchanged with other digital systems in the localenvironment 240 (or outside this environment by way of a gateway orportal) via, e.g. the Wi-Fi interface 302, Ethernet interface 304 orplug-and-play (PnP) interface 318.

Additionally, the RF front end 301 modulates, encrypts/multiplexes asrequired, and transmits digital information for receipt by upstreamentities such as the CMTS or a network server. Digital data transmittedvia the RF front end 301 may include, for example, MPEG-2 encodedprogramming data that is forwarded to a television monitor via the videointerface 316. Programming data may also be stored on the CPE storageunit 308 for later distribution by way of the video interface 316, orusing the Wi-Fi interface 302, Ethernet interface 304, Firewire (IEEEStd 1394), USB/USB2, or any number of other such options.

Other devices such as portable music players (e.g., MP3 audio players)may be coupled to the CPE 106 via any number of different interfaces,and music and other media files downloaded for portable use and viewing.

In some instances, the CPE 106 includes a DOCSIS cable modem fordelivery of traditional broadband Internet services. This connection canbe shared by all Internet devices in the premises 240; e.g. Internetprotocol television (IPTV) devices, PCs, laptops, etc., as well as byroaming devices 290. In addition, the CPE 106 can be remotely managed(such as from the head end 150, or another remote network agent) tosupport appropriate IP services. Again, it should be noted that someembodiments provide a cloud-based user interface, wherein CPE 106accesses a user interface on a server in the cloud, such as in NDC 120.

In some instances the CPE 106 also creates a home Local Area Network(LAN) utilizing the existing coaxial cable in the home. For example, anEthernet-over-coax based technology allows services to be delivered toother devices in the home utilizing a frequency outside (e.g., above)the traditional cable service delivery frequencies. For example,frequencies on the order of 1150 MHz could be used to deliver data andapplications to other devices in the home such as PCs, PMDs, mediaextenders and set-top boxes. The coaxial network is merely the bearer;devices on the network utilize Ethernet or other comparable networkingprotocols over this bearer.

The exemplary CPE 106 shown in FIGS. 5 and 6 acts as a Wi-Fi accesspoint (AP), thereby allowing Wi-Fi enabled devices to connect to thehome network and access Internet, media, and other resources on thenetwork. This functionality can be omitted in one or more embodiments.

In one embodiment, Wi-Fi interface 302 comprises a single wirelessaccess point (WAP) running multiple (“m”) service set identifiers(SSIDs). One or more SSIDs can be set aside for the home network whileone or more SSIDs can be set aside for roaming devices 290.

A premises gateway software management package (application) is alsoprovided to control, configure, monitor and provision the CPE 106 fromthe cable head-end 150 or other remote network node via the cable modem(DOCSIS) interface. This control allows a remote user to configure andmonitor the CPE 106 and home network. Yet again, it should be noted thatsome embodiments provide a cloud-based user interface, wherein CPE 106accesses a user interface on a server in the cloud, such as in NDC 120.The MoCA interface 391 can be configured, for example, in accordancewith the MoCA 1.0, 1.1, or 2.0 specifications.

As discussed above, the optional Wi-Fi wireless interface 302 is, insome instances, also configured to provide a plurality of unique serviceset identifiers (SSIDs) simultaneously. These SSIDs are configurable(locally or remotely), such as via a web page.

In addition to “broadcast” content (e.g., video programming), thesystems of FIGS. 1-6 also deliver Internet data services using theInternet protocol (IP), although other protocols and transportmechanisms of the type well known in the digital communication art maybe substituted. The IP packets are typically transmitted on RF channelsthat are different that the RF channels used for the broadcast video andaudio programming, although this is not a requirement. The CPE 106 areeach configured to monitor the particular assigned RF channel (such asvia a port or socket ID/address, or other such mechanism) for IP packetsintended for the subscriber premises/address that they serve.

According to an embodiment of the present invention, data correspondingto user consumption of a resource (e.g., service usage) is normalized bytime sequence sampling or timestamping. Timestamp normalized dataenables enhanced reporting methods.

In one or more embodiments of the present invention, the data iscaptured on a per subscriber basis (e.g., from a cable modem of asubscriber) and/or per service group (e.g., one or more cable modems).In one or more exemplary embodiments, the data is captured at timesdetermined by a driver for IPDR. For example, the driver for IPDRgenerates a polling solution that can lack time-regularity forindividual counter-read events; in one or more exemplary embodiments thecounters are polled/read when the CMTS has sufficient free transmissioncycles to report counter data to a poller, and is thus less intrusivethan regularly scheduled polling. Exemplary embodiments of the presentinvention timestamp normalize the IPDR data having irregulartime-ranges/timestamps, enforcing a time-range-framing over theirregular timestamps in the IPDR data.

In one or more exemplary embodiments of the present invention, the datais IPDR data, Simple Network Management Protocol (SNMP) data, or acombination of IPDR and SNMP data with separate normalization. Inanother exemplary embodiment, the data is formatted according to anInternet Protocol Flow Information Export (IPFIX) standard, whereinIPFIX defines how IP (Internet Protocol) flow information is to beformatted and transferred from an exporter to a collector. It should beunderstood that the systems and methods described herein are not limitedto the disclosed data formats or standards, and that exemplaryembodiments are applicable to other data formats. The followingdescription refers to an exemplary IPDR implementation. Again, aspectsof the exemplary implementation are applicable to other types of data.

FIG. 8 is an exemplary architecture of a network 800 processing IPDRdata according to an embodiment of the present invention. In the network800, a CMTS 801 is disposed for example in a headend and receives rawdata from consumer devices (not explicitly shown) (e.g., set-topdevices). The CMTS 801 embodies a counter or flow counter (referredhereinafter as a “counter”). In at least one embodiment, the countergives speed value (MB/s) or a running total number of octets (bytes) oftraffic or packets through an interface of the CMTS 801. The CMTS 801gathers counter data (e.g., raw data from a cable modem in a servicegroup of the CMTS) at irregular intervals. The CMTS 801 communicates theraw data to a collector 802 disposed at a regional data center. Itshould be understood that the collector 802 can be disposed at differentlocations and is not limited to deployment at a regional data center.The collector 802 drives the raw data to a unit based pricing (UBP)mediation appliance 803 and a mediator 804. The mediator 804, alsodisposed at the regional data center, performs timestamp normalizationon the raw data. In one or more exemplary embodiments of the presentinvention, a portion of the raw IPDR data can be correlated with SNMPdata by timestamp normalization.

It should be understood that the mediator 804 can be disposed atdifferent locations and is not limited to deployment at a regional datacenter. The mediator 804 outputs timestamp normalized data to a datawarehouse 805. In one or more embodiments, the mediator 804 also outputsthe raw data to the data warehouse 805. According to an embodiment ofthe present invention, business intelligence (BI) tools 806 are deployedto act on the data warehouse 805 for purposes of capacity planning,technology strategy, commercial services, etc. For example, the BI tools806 can be deployed to determine where and when in the architecturecertain usage occurred.

Within the network 800, the data being passed between elements can havevarious formats. For example, an IPDR Streaming Protocol (SP) is used tocommunicate raw data (e.g., counter values) from the CMTS to thecollector 802 and the UBP mediation appliance 803. In at least oneembodiment, the collector 802 uses a vendor neutral program informationfile format with secure copy (SCP). The mediator 804 and data warehousecommunicate using extract, transform and load (ETL) processes with SCPfor comma-separated values CSV files.

It should be understood that methods and formats of communication arenon-limiting examples and that other methods and formats can be used.

According to an embodiment of the present invention, within the network800, the mediator 804 normalizes timestamp data. Referring to FIG. 9, inan exemplary production topology 900, collector systems 901, aredisposed throughout regional data centers (RDC). The collector systemsdrive the raw data including the counter values to the mediator systems902. The mediator systems 902 timestamp normalize the raw data. Moreparticularly, the mediator systems 902 normalize the counter values inthe raw data to particular times (described in more detail withreference to FIGS. 10-12). The timestamp normalized data is provided toa data warehouse 903.

The timestamp normalized data stored at the data warehouse 903 enablesgranular (e.g., on the scale of minutes) analysis. For example, databasequeries (e.g., structured query language (SQL) queries) can be appliedto the timestamp normalized SNMP data. In one example, statements aboutthroughput can be aggregated across the network, with results applied tonetwork engineering, capacity planning, technology strategy andcommercial services.

Referring to FIG. 10, an exemplary collector-mediator-databasearchitecture is illustrated. A collector 1001 comprises exporters 1002for connected mediators and UBP appliances. A mediator 1003 receives rawIPDR data from the collector 1001. The mediator 1003 is configured toperformed operations of receiving counter values and corresponding thetimestamps when the values were read at 1004, applying metrics at 1005(e.g., converting the counter values into ranged data), timestampnormalizing data at 1006 and performing a database load at 1007. In oneor more exemplary embodiments of the present invention, a subset of theraw IPDR data can be correlated with SNMP data by timestampnormalization. A database 1008 receives the timestamp normalized data1006 from the mediator 1003. The database 1008 further receives rawreference data 1009 (e.g., counter values). In one or more embodimentsof the present invention, the database 1008 performs a rollup operation1010 to produce capacity reports 1011.

The rollup operation 1010 includes operations such as correlation ofdata from multiple sources, correlation of IPDR data and SNMP data,repair of impairments in the timestamp normalized data (e.g., mitigatingmissing SNMP polls using IPDR data correlated to SNMP), generation ofprojections of future usage based on the timestamp normalized data 1006,etc. The rollup operation 1010 allows the timestamp normalized data tobe rolled up into capacity and business intelligence reports. Thereports can include information about IPTV traffic per service group, acomparison of residential versus commercial traffic per service group,etc. Other aggregations of clients are possible.

FIG. 11 is a graph 1100 of exemplary service consumption data accordingto an embodiment of the present invention. In FIG. 11 the distributionof service consumption 1101 is plotted as usage (in minutes) against ameasure of frequency (i.e., consumer behavior). For example, at datapoint 1102 it can be observed that 761,477 subscribers, representingabout 51% of the subscriber population, established sessions lastingbetween about 15 minutes and 30 minutes. The data of FIG. 11 illustratessubscriber behavior. The raw data resulting from the subscriber behavioris illustrated in FIG. 12 together with timestamp normalized SNMP data.

FIG. 12 is an illustration 1200 of timestamp normalized data accordingto an embodiment of the present invention. In FIG. 12 60 minutes of timeis divided into four timestamp buckets (1201-1204, respectively). Theprocess of timestamp normalizing the raw data categorizes the raw data(e.g., data consumption) into the timestamp buckets. The raw data fordifferent consumers is illustrated, e.g., 1205 and 1207, across thesetimestamp buckets. The mediators operate to timestamp normalize the rawdata, converting the raw data into start and stop timestamps. Forexample, in the case of raw data 1205, the usage is normalized to the30-minute bucket 1202. In another example, the raw data 1207 isnormalized by dividing the usage data among two buckets 1202 and 1203.Therefore, the raw data 1207 is normalized into two separate occurrencesat 1208 and 1209 at the 30-minute bucket 1202 and the 45-minute bucket1203, respectively.

FIG. 13 is an exemplary architecture of a network 1300 processing datausing a hub 1301 according to an embodiment of the present invention.The hub 1301 includes a CMTS 1302. The CMTS 1302 is associated with aservice group 1303 comprising one or more subscriber devices 1304 (e.g.,cable modems). The CMTS 1302 is disposed in communication with an IPDRcollector 1305 and an SNMP poller 1306. The IPDR collector 1305 and theSNMP poller 1306 are further connected to respective mediators (forexample, 803 and 804, FIG. 8) providing respective IPDR data and SNMPdata to the mediators. According to an exemplary embodiment of thepresent invention, the data warehouse (see, for example, 805, FIG. 8) isconfigured to correlate of data from multiple sources, including IPDRdata and SNMP data.

The SNMP poller 1306 polls the CMTS 1302 (e.g., on interface octetcounters), from which interface utilization can be derived. As shown inFIG. 13, the SNMP poller 1306 can also poll the Hub Routers 1307 and1308. In one or more embodiments of the present invention, the CMTS 1302does not poll SNMP data from the cable modems (e.g., 1304). The data atthe subscriber devices 1304 is IPDR based. In one or more exemplaryembodiments of the present invention, a portion of the IPDR data can becorrelated with SNMP data by timestamp normalizing the IPDR data.

The hub 1301 further includes one or more hub routers (e.g., 1307 and1308). A Deep Packet Inspection (DPI) probe 1309 operates taps orinspection points (e.g., 1310 and 1311) between the CMTS 1302 and thehub routers 1307 and 1308. The DPI probe 1309 outputs counter data to aDPI reporting server 1312. DPI is useful in, for example, gatheringstatistical information about a usage pattern of a service group.Similar to the IPDR collector 1305 and the SNMP poller 1306, the DPIreporting server 1312 provides counter data to a mediator, whichtimestamp normalizes counter data collected by the DPI probe and makesthe timestamp normalized data available in the data warehouse.

System and Article of Manufacture Details

The invention can employ hardware aspects or a combination of hardwareand software aspects. Software includes but is not limited to firmware,resident software, microcode, etc. One or more embodiments of theinvention or elements thereof can be implemented in the form of anarticle of manufacture including a machine readable medium that containsone or more programs which when executed implement such step(s); that isto say, a computer program product including a tangible computerreadable recordable storage medium (or multiple such media) withcomputer usable program code configured to implement the method stepsindicated, when run on one or more processors. Furthermore, one or moreembodiments of the invention or elements thereof can be implemented inthe form of an apparatus including a memory and at least one processorthat is coupled to the memory and operative to perform, or facilitateperformance of, exemplary method steps.

Yet further, in another aspect, one or more embodiments of the inventionor elements thereof can be implemented in the form of means for carryingout one or more of the method steps described herein; the means caninclude (i) specialized hardware module(s), (ii) software module(s)executing on one or more general purpose or specialized hardwareprocessors, or (iii) a combination of (i) and (ii); any of (i)-(iii)implement the specific techniques set forth herein, and the softwaremodules are stored in a tangible computer-readable recordable storagemedium (or multiple such media). The means do not include transmissionmedia per se or disembodied signals per se. Appropriate interconnectionsvia bus, network, and the like can also be included.

FIG. 7 is a block diagram of a system 700 that can implement at leastsome aspects of the invention, and is representative, for example, ofone or more of the servers shown in the figures. As shown in FIG. 7,memory 730 configures the processor 720 to implement one or moremethods, steps, and functions (collectively, shown as process 780 inFIG. 7). The memory 730 could be distributed or local and the processor720 could be distributed or singular. Different steps could be carriedout by different processors.

The memory 730 could be implemented as an electrical, magnetic oroptical memory, or any combination of these or other types of storagedevices. It should be noted that if distributed processors are employed,each distributed processor that makes up processor 720 generallycontains its own addressable memory space. It should also be noted thatsome or all of computer system 700 can be incorporated into anapplication-specific or general-use integrated circuit. For example, oneor more method steps could be implemented in dedicated hardware (such asASIC) rather than using software. Display 740 is representative of avariety of possible input/output devices (e.g., keyboards, mice, and thelike). Every processor may not have a display, keyboard, mouse or thelike associated with it.

As is known in the art, part or all of one or more aspects of themethods and apparatus discussed herein may be distributed as an articleof manufacture that itself includes a tangible computer readablerecordable storage medium having computer readable code means embodiedthereon. The computer readable program code means is operable, inconjunction with a computer system (including, for example, system 700or the like), to carry out all or some of the steps to perform themethods or create the apparatuses discussed herein. A computer readablemedium may, in general, be a recordable medium (e.g., floppy disks, harddrives, compact disks, EEPROMs, or memory cards) or may be atransmission medium (e.g., a network including fiber-optics, theworld-wide web, cables, or a wireless channel using time-divisionmultiple access, code-division multiple access, or other radio-frequencychannel). Any medium known or developed that can store informationsuitable for use with a computer system may be used. Thecomputer-readable code means is any mechanism for allowing a computer toread instructions and data, such as magnetic variations on a magneticmedia or height variations on the surface of a compact disk. The mediumcan be distributed on multiple physical devices (or over multiplenetworks). As used herein, a tangible computer-readable recordablestorage medium is defined to encompass a recordable medium, examples ofwhich are set forth above, but is defined not to encompass atransmission medium or disembodied signal.

The computer systems and servers and other pertinent elements describedherein each typically contain a memory that will configure associatedprocessors to implement the methods, steps, and functions disclosedherein. The memories could be distributed or local and the processorscould be distributed or singular. The memories could be implemented asan electrical, magnetic or optical memory, or any combination of theseor other types of storage devices. Moreover, the term “memory” should beconstrued broadly enough to encompass any information able to be readfrom or written to an address in the addressable space accessed by anassociated processor. With this definition, information on a network isstill within a memory because the associated processor can retrieve theinformation from the network.

Accordingly, it will be appreciated that one or more embodiments of thepresent invention can include a computer program comprising computerprogram code means adapted to perform one or all of the steps of anymethods or claims set forth herein when such program is run, forexample, on a virtualized or non-virtualized hardware serverimplementing one or more of the blocks/sub-blocks 1003, 1004, 1005,1006, 1007, 1010 and the like, and that such program may be embodied ona tangible computer readable recordable storage medium. As used herein,including the claims, unless it is unambiguously apparent from thecontext that only server software is being referred to, a “server”includes a physical data processing system (for example, system 700 asshown in FIG. 7) running one or more server programs. It will beunderstood that such a physical server may or may not include a display,keyboard, or other input/output components. Furthermore, as used herein,including the claims, a “router” includes a networking device with bothsoftware and hardware tailored to the tasks of routing and forwardinginformation.

Furthermore, it should be noted that any of the methods described hereincan include an additional step of providing a system comprising distinctsoftware modules embodied on one or more tangible computer readablestorage media. All the modules (or any subset thereof) can be on thesame medium, or each can be on a different medium, for example. Themodules can include any or all of the components shown in the figures(e.g. modules/sub-modules to implement blocks/sub-blocks 1003, 1004,1005, 1006, 1007, 1010, etc.). The method steps can then be carried outusing the distinct software modules of the system, as described above,executing on one or more hardware processors. Further, a computerprogram product can include a tangible computer-readable recordablestorage medium with code adapted to be executed to carry out one or moremethod steps described herein, including the provision of the systemwith the distinct software modules.

Accordingly, it will be appreciated that one or more embodiments of theinvention can include a computer program including computer program codemeans adapted to perform one or all of the steps of any methods orclaims set forth herein when such program is implemented on a processor,and that such program may be embodied on a tangible computer readablerecordable storage medium. Further, one or more embodiments of thepresent invention can include a processor including code adapted tocause the processor to carry out one or more steps of methods or claimsset forth herein, together with one or more apparatus elements orfeatures as depicted and described herein.

Although illustrative embodiments of the present invention have beendescribed herein with reference to the accompanying drawings, it is tobe understood that the invention is not limited to those preciseembodiments, and that various other changes and modifications may bemade by one skilled in the art without departing from the scope orspirit of the invention.

What is claimed is:
 1. A method comprising: collecting, over a timeperiod, counter data corresponding to usage of a network resource,wherein the counter data includes timestamp data, and wherein thecollection of the counter data is performed by a counter device atirregular intervals; dividing the time period into a plurality ofbuckets, each of the buckets having a stop timestamp; and converting thecounter data into timestamp normalized counter data, wherein theconversion comprises: dividing the counter data among the plurality ofbuckets according to the timestamp data of the counter data; andenforcing a time-range-framing over the timestamp data of the counterdata by converting a stop timestamp of the counter data to the stoptimestamp of a respective one of the buckets containing the counterdata, wherein different portions of the timestamp normalized counterdata are placed in different buckets of the plurality of buckets, andwherein at least one individual occurrence of the counter dataoverlapping at least a first bucket and a second bucket of the pluralityof buckets is divided into a plurality of occurrences of the timestampnormalized counter data placed in at least said first and second bucketswith the stop timestamps of the occurrences converted to the stoptimestamps of the respective buckets, the timestamp normalized counterdata supporting database queries.
 2. The method of claim 1, furthercomprising storing the timestamp normalized counter data comprising thestop timestamps in a data warehouse.
 3. The method of claim 1, whereinthe counter data is collected from multiple sources on a network, themultiple sources comprising one of a plurality of subscribers, at leastone subscriber and at least one service group, and a plurality ofservice groups.
 4. The method of claim 3, further comprising repairingan impairment in the timestamp normalized data, wherein the counter datais Simple Network Management Protocol (SNMP) data and wherein thetimestamped normalized data is normalized SNMP data, and wherein therepairing comprises mitigating a missing portion of the normalized SNMPdata using Internet Protocol Detail Record (IPDR) data collected from acable modem termination system (CMTS) providing the network resource toat least one subscriber among the multiple data sources and correlatedto the SNMP data.
 5. The method of claim 1, further comprisinggenerating a projection of future usage of the network resource usingthe timestamp normalized counter data.
 6. The method of claim 1, whereinthe counter device is a cable modem termination system (CMTS) providingthe network resource to at least one subscriber among the multiple datasources.
 7. A network system comprising: a counter providing a networkresource to at least one subscriber of the network system; a datawarehouse; a collector collecting, from the counter, counter datacorresponding to usage of the network resource, wherein the counter dataincludes timestamp data; and a mediator comprising at least oneprocessor executing instructions stored in a memory to convert thecounter data into timestamp normalized counter data, and storing thetimestamped normalized counter data in the data warehouse, wherein theconversion of the counter data includes dividing the counter data amonga plurality of buckets according to the timestamp data of the counterdata and enforcing a time-range-framing over the timestamp data of thecounter data by converting a stop timestamp of the counter data to astop timestamp of a respective one of the buckets containing the counterdata, wherein different portions of the timestamp normalized counterdata are placed in different buckets of the plurality of buckets, andwherein at least one individual occurrence of the counter dataoverlapping at least a first bucket and a second bucket of the pluralityof buckets is divided into a plurality of occurrences of the timestampnormalized counter data placed in at least said first and second bucketswith the stop timestamps of the occurrences converted to the stoptimestamps of the respective buckets, the timestamp normalized counterdata supporting database queries, wherein the collector and the mediatorare disposed between the counter and the data warehouse.
 8. The networksystem of claim 7, wherein the data warehouse comprises a rollup moduleconfigured to repair an impairment in the timestamp normalized counterdata, wherein the counter data is Simple Network Management Protocol(SNMP) data and wherein the timestamped normalized data is normalizedSNMP data, and wherein the repair comprises mitigating a missing portionof the normalized SNMP data using Internet Protocol Detail Record (IPDR)data collected from the counter and correlated to the SNMP data.
 9. Thenetwork system of claim 7, wherein the data warehouse comprises a rollupmodule configured to generate a projection of future usage of thenetwork resource using the timestamp normalized counter data.
 10. Thenetwork system of claim 7, wherein the counter data includes firstcounter data corresponding to usage of the network resource by a servicegroup including the at least one subscriber, and second counter datacorresponding to usage of the network resource by a first subscriber ofthe at least one subscriber.
 11. The network system of claim 7, whereinthe collector comprises an Internet Protocol Detail Record (IPDR)collector collecting IPDR data from the counter and a Simple NetworkManagement Protocol (SNMP) poller polling SNMP data from the counter.12. The network system of claim 7, further comprising: a Deep PacketInspection (DPI) probe operating at least one tap between the counterand a hub router; and a DPI reporting server collecting SNMP data fromthe DPI probe, wherein the DPI probe and DPI reporting server areconfirmed as the collector collecting, from the counter, the counterdata corresponding to usage of the network resource.
 13. An article ofmanufacture comprising a computer program product for timestampnormalizing counter data, the computer program product comprising: acomputer-readable recordable storage medium storing non-transitorycomputer readable program code, the computer readable program codecomprising: computer readable program code executed by at least oneprocessor to collect, over a time period, counter data corresponding tousage of a network resource, wherein the counter data includes timestampdata, and wherein the collection of the counter data is performed by acounter device at irregular intervals; computer readable program codeexecuted by at least one processor to divide the time period into aplurality of buckets, each of the buckets having a stop timestamp; andcomputer readable program code executed by the at least one processor toconvert the counter data into timestamp normalized counter data bydividing the counter data among the plurality of buckets according tothe timestamp data of the counter data and enforcing atime-range-framing over the timestamp data of the counter data byconverting a stop timestamp of the counter data to the stop timestamp ofa respective one of the buckets containing the counter data, whereindifferent portions of the timestamp normalized counter data are placedin different buckets of the plurality of buckets, and wherein at leastone individual occurrence of the counter data overlapping at least afirst bucket and a second bucket of the plurality of buckets is dividedinto a plurality of occurrences of the timestamp normalized counter dataplaced in at least said first and second buckets with the stoptimestamps of the occurrences converted to the stop timestamps of therespective buckets.
 14. The article of manufacture of claim 13, furthercomprising computer readable program code executed by the at least oneprocessor to store the timestamp normalized counter data in a memorydevice supporting database queries on the timestamp normalized counterdata.
 15. The article of manufacture of claim 13, further comprisingcomputer readable program code executed by the at least one processor tocorrelate the counter data from multiple sources on a network, themultiple sources comprising one of a plurality of subscribers, at leastone subscriber and at least one service group, and a plurality ofservice groups.
 16. The article of manufacture of claim 15, furthercomprising computer readable program code executed by the at least oneprocessor to repair an impairment in the timestamp normalized data,wherein the counter data is Simple Network Management Protocol (SNMP)data and wherein the timestamped normalized data is normalized SNMPdata, and wherein the repairing comprises mitigating a missing portionof the normalized SNMP data using Internet Protocol Detail Record (IPDR)data collected from a cable modem termination system (CMTS) providingthe network resource to at least one subscriber among the multiple datasources and correlated to the SNMP data.
 17. The article of manufactureof claim 13, further comprising computer readable program code executedby the at least one processor to generate a projection of future usageof the network resource using the timestamp normalized counter data.